ZwCreateFile and CloseFile are not called in pairs

[forworldm]

is this expected behaviour?

[Liryna]

You should always have ZwCreateFile followed by a CloseFile but the elapse time depends on when the source application call Close.

[forworldm]

the CloseFile is not called on some files opened by the windows explorer. even DokanCloseHandle doesn't seem to call CloseFile.

[Liryna]

Explorer will some time keep a handle open while a folder is displayed. You cannot control for how long applications will keep a handle open.
Dokanclosehandle does not close application handles. See the documentation.